Privacy and your data
What we store
| Data | Why | Where it comes from |
|---|---|---|
| Product and variant records | To price the widget and populate the plan builder | Your Shopify catalogue |
| Customer name, email, address | To send notifications and sign customers into the portal | Shopify, with your approval |
| Subscription contracts and their history | To run the dashboard and the portal | Shopify |
| Orders linked to subscriptions | To show charge history | Shopify |
| Your plan configuration | It is the app | You |
What we never store
Card numbers, bank details or any payment instrument. Payment methods are vaulted by Shopify. We can ask Shopify whether a contract has a usable payment method; we cannot see what it is. When a customer updates their card they do it on a page Shopify hosts.
We also do not store passwords. Portal sign-in uses a one-time code sent to the customer's email.
Protected customer fields
Shopify treats customer name, email, phone and address as protected customer data, approved separately from ordinary app permissions. We request only three of the four:
- Email — renewal reminders, failed-payment notices, and portal sign-in codes. Without it there is no way to reach a subscriber at all.
- Name — addressing those messages.
- Phone — not requested. We do not ask for it and do not store it. WhatsApp and SMS notifications are not released yet; when they are, we will request phone access then and update this page first.
- Address — shipping the subscription.
If approval has not been granted, the app degrades rather than breaks: subscriptions still bill, because Shopify handles that. Notifications and portal sign-in do not work, because there is nowhere to send to. We store only what Shopify actually returns — a withheld field is left absent rather than overwritten with a blank, so nothing already known is erased.
Encryption
In transit: everything over HTTPS.
At rest: the database is encrypted, and access tokens are encrypted again at the application level with a separate key, so a database copy alone does not yield working credentials.
Backups: encrypted before they are written, with a key whose private half is not kept on the server that makes them. A copy of our server does not yield a readable backup. Restores are tested, not assumed.
Retention and deletion
We keep your data while the app is installed, but not all of it for the whole time. Specific categories expire on a schedule, enforced by a job that runs every day:
| Data | Kept for | Then |
|---|---|---|
| Raw event payloads from Shopify | 30 days | Deleted |
| A subscriber's personal data after their last subscription is cancelled | 90 days | Name, email and address erased |
| Access logs | 90 days | Deleted |
| Backups | 30 days | Expire |
Deletion means deletion — the rows are removed or the fields are emptied. We do not keep the data behind a flag that hides it.
When you uninstall, Shopify notifies us and we delete your shop's data within 48 hours, as Shopify requires. Your subscription contracts stay on your Shopify store — they are Shopify's objects and they belong to you.
Export anything you want to keep before uninstalling.
Customer deletion requests. Shopify forwards GDPR-style requests to us and we act on them:
- Customer data request — we return everything we hold on that customer
- Customer redact — we delete their personal data, keeping only anonymised financial records where law requires
- Shop redact — we delete the entire shop's data
Who can see your data
Your data is yours. We do not sell it, share it with advertisers, or use it to train anything.
Super Subscription is operated by one person at Proscube. That person is the only human with production access, and every time they read, export or change a subscriber's personal data it is recorded — who, when, what record, which store, and from which address.
That record is append-only: the application cannot edit or delete it, because the database itself refuses. It is reviewed monthly, and entries older than 90 days are removed.
Keeping personal data out of our logs
Names, email addresses, phone numbers, addresses and customer identifiers are stripped before anything is written to a log file or an error report. They are replaced with [redacted] rather than a scrambled version of the value, because a consistent scramble of an email address still identifies the person.
Our development environment never holds real customer data, and the application refuses to start if it is pointed at the wrong database.
Sub-processors
| Provider | Purpose | Where |
|---|---|---|
| Amazon Web Services | Hosting and the database | India (ap-south-1) |
| Resend | Transactional email — renewal reminders, failed-payment notices, sign-in codes | EU/US |
We will update this list before adding a sub-processor that touches customer data.
Your obligations
You are the data controller for your customers' data; we are a processor acting on your instructions. You should have a privacy policy telling your customers that a subscription app processes their data on your behalf. Shopify requires this of all merchants.
Some jurisdictions require advance notice before charging a recurring payment — see Notifications for renewal reminders.